Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Linux > Quiz > Flashcards

Quiz Flashcards

1
Q

what is iptables used for

A

host based IP filtering

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

the following command tells you what?

grep ^$ file1.txt | wc-l

A

There are 30 blank lines in file1.txt

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is the expected output of the following command:

grep -v ‘^$’ message.txt

A

any line that is not a blank line in message.txt

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Right now I can’t use ‘sudo’, what file needs to be updated to allow a regular user to run commands

A

/etc/sudoers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

When working with a disk image containing an MBR, most Sleuthkit commands require information provided by what commands?

A

fdisk or mmls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

In the following command what does the ‘.’ signify?

find . -name ‘myfile.txt’

A

start in current directory

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What are the differences in systemd and BSD style init systems

A

systemd uses targets while BSD init uses runlevels

BSD runs linearly
systemd runs parallel

BSD uses text based
systemd uses binary system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Given the below forensic image containing two NTFS partitions, what will the following command display?

mmls suspect_image.raw

A

The offsets to each file system in the image

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is the sed command most often used for?

A

editing a stream of data, usually in ascii

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What was Bash designed to be

A

A replacement to the original UNIX Bourne shell

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

In Regex, what symbol means “zero or one of the preceding characters?

A

?

    • zero, one or more
      + - one or more
      ‘' - match previous or next character/group
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is the only linux distribution suitable for digital forensics?

A

all linux distributions can be configured to work for digital forensics, depending on the investigators needs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What file do you need to restart a ddrescue acquisition

A

map file

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What information would you expect from the fls - Frd command

Example: fls -o 10260 -Frd able2.dd

A

-F (only files entries)
-d (deleted entries)
-r (recursive)

r/r - indicates the file type (r-regular, d-directory)
* - indicates the
file is deleted or unallocated,

Output:
r/r * 10063: var/log/xferlog.5
r/r * 10063: var/lock/makewhatis.lock
r/r * 2139: dev/ttYZ0/lrkn.tgz
d/r * 10071(realloc): dev/ttYZ0/lrk3

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

The first 10 characters of ‘ls -l’ are reserved for what information?

Example:
brw-rw—-

A

File type information and read(4)/write(2)/execute(1) permissions

the object is a block device file with permissions 660

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

True/False: lsblk will not show a flash based storage device because flash based devices are not recognized by the SCSI driver

A

False

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Given a data block from a file system containing interesting text, I can determine the metadata entry (MFT entry, inode, etc.) that points to that data block using what command?

A

ifind with the -d option

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What does the dd command do?

A

-can be used to restore a hard drive to a previous state, given a dd image previously collected from the same hd
-can be used to acquire disk images
-can be used to copy a file from one location to another

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What information will be displayed when you add a metadata entry number to the fls command

A

display the contents of that directory / metadata entry number

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What are the permissions for the octal value 774

A

rwxrwxr–

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What does this command output:

xxd image.dd | grep ‘aad9bcf3’

A

it will output the occurrences of ascii ‘aad9bcf3’ if it is located in xxd output

22
Q

what does the command ewfexport do

A

exports a virtual fuse mounted raw image

take an EWF file set and convert it to a bit stream image file, essentially removing the meta data and leaving us with the data in raw format, as with dd.

23
Q

What command can be used to associate multiple partitions in the image to separate loop devices

A

losetup -Pr image.raw

losetup -P maps partitions within an image to separate loop devices that can then be mounted the same as any other volume

24
Q

What command obtains a serial number from a USB flash drive

A

lsusb -v

25
Q

What does the following command output:

grep -i ‘it’ thinking.txt

A

strings containing ‘IT’, ‘it’, ‘It’

-i = case insensitive

26
Q

What is the following command doing:

dc3dd if=/dev/sda | nc 192.168.55.18 2020

A

dc3dd is imaging /dev/sda device, on the source computer, and porting over the extracted data to IP address on port 2020

the collection/receiving computer has an open nc connection on port 2020

27
Q

What is an advantage of using dc3dd over dd

A

dc3dd has logging and hashing capabilities built in

28
Q

What are the commands used to install software “from source”

A

’./configure’ command sets environment variables and enables or disables program features based on available libraries and arguments

‘make’ command compiles the program

‘install’ command moves the compiled executables

sboinstall - installs from packages

To install a Slackware package, when we are not using the slackpkg front end, we use the pkgtool command installpkg

29
Q

What will the blkcat command output

A

directly stream the contents of a data block you specify

30
Q

What command will identify a file system on a block device (/dev/sdc1)

A

file -s /dev/sdc1

31
Q

The output from what command can be piped into another command to calculate the hash, check a file type, or view contents

A

icat

32
Q

What command should be used to stream contents of data blocks associated with a particular metadata entry

A

icat

33
Q

What does the d input indicate in the following command

ifind -o 2048 -d 232989 image.raw

A

the -d input is associated with a data block / inode

a data block from the file system at offset 2048 from image.raw

34
Q

What command can be used to identify file system blocks associated with a metadata entry

A

istat

35
Q

What command will show all the lines in file file2.txt that contain the string ‘McDonald’

A

grep ‘McDonald’ file2.txt

grep -i mcdonald file2.txt

36
Q

Given the hexadecimal number “0xCCE4F8”, the commands “echo $((cce4f8)) and “echo ‘ibase=16;cce4f8’ | bc” would output what

A

an incorrect value

correct command would be

echo “ibase=16; cce4f8” | bc
echo $((0xcce4f8))

37
Q

What grep expression would match the following output:

201981131:15:46:15 log entry created

A

^[[:digit:]]{8}

38
Q

What do package managers allow a user to do?

A

Keep track of what packages are installed

they do not install optional dependencies by default

39
Q

What command will mount a split raw image file and access it as a single raw image

A

affuse

40
Q

What command will recursively list only the unallocated files of a directory with an MFT number 44 contained in image.raw with file system starting at 2048

A

fls -o 2048 -Frd image.raw 44

41
Q

What command will result in a loop device that contains only the NTFS volume at offset 59

A

losetup -o $((59*512))

42
Q

What command can be used to check to see if a disk has been wiped (with all 0’s)

A

xxd -a /dev/sdd

43
Q

What is a benefit of using a package manager compared to downloading source code

A

package manager keeps track of what has been installed

downloading from source allows for customization

44
Q

What command can be used to show kernel messages to detect devices

A

dmesg

45
Q

What is the following command doing if /dev/sdd is a 4G drive:

dc3dd if=/dev/sdd ofs=image.000 ofsz=2G log=image.log

A

a forensic image image of device with images image.000 and image.001

46
Q

What directory usually contains system binary files that are run by root

A

sbin

47
Q

What is true about md5sum and sha1sum

A

You can has data coming through netcat pipe

they can’t be used to compress files

cannot use hash value to recreate a file

48
Q

What does the -exec parameter of the find command do

A

execute the following command on every file found

49
Q

A correct fls -Dd command will accomplish what?

A

A list of deleted directories but not deleted sub-directories of deleted directories (not recursive)

50
Q

How would you unmount a volume mounted at /mnt/analysis at /dev/sdb1

A

umount /mnt/analysis or umount /dev/sdb1

Linux (2 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions